Data Protection Officer

About the role

CARMA is seeking an experienced Data Protection Officer to lead its global privacy programme across MENA, Europe and Asia. The role will ensure compliance with applicable data protection laws, oversee privacy governance, and act as the primary contact for regulators and supervisory authorities.

Key responsibilities

• Develop, implement and continuously improve the company’s global privacy programme.
• Maintain privacy governance policies, standards and procedures and embed privacy controls across all business functions.
• Create regional privacy compliance frameworks for MENA, EU and Asia and establish governance committees and reporting mechanisms.
• Ensure compliance with GDPR, UK GDPR, ePrivacy, UAE PDPL, Saudi PDPL, Oman PDPL, Singapore PDPA, Hong Kong PDPO, Japan APPI and other relevant regulations.
• Lead Data Protection Impact Assessments (DPIAs) and Privacy Impact Assessments, maintain DPIA registers and mitigate privacy risks.
• Oversee data subject rights processes, including access, correction, erasure, portability, restriction, objection and automated decision‑making requests.
• Lead privacy incident and breach response, assess reportability, coordinate investigations and liaise with regulators.
• Manage third‑party privacy compliance and deliver privacy training across the organisation.

Required profile

• Five to seven years of relevant experience, with at least three years dedicated to privacy or data protection.
• Strong, demonstrable knowledge of GDPR and a range of international data protection regulations.
• Proven ability to design and operate global privacy programmes across multiple regions.

Required skills

• In‑depth knowledge of GDPR, UK GDPR, ePrivacy, UAE PDPL, Saudi PDPL, Oman PDPL, Singapore PDPA, Hong Kong PDPO, Japan APPI.
• Experience conducting DPIAs and managing data subject rights requests.
• Expertise in privacy incident handling and regulatory liaison.